navori 0.11.1 → 0.11.2

package/dist/assets/core/core-assets/agents/implementer.md

@@ -5,7 +5,7 @@ tools: Read, Write, Edit, Glob, Grep, Bash
 model: {{models.implementer}}
 effort: {{effort.implementer}}
 maxTurns: 160
-maxWords: 2433
+maxWords: 2448
 ---
 
 # Implementer Agent
@@ -41,7 +41,7 @@ You execute **a single** task from start to verification. You don't orchestrate,
    {{qualityGate.fast}}
    ```
 
-   If it fails: fix it and re-run. Don't return with red. You are the single owner of this gate run: never share it with another process, never poll `pgrep`/`ps` for it, and a timeout is never a success signal. If the gate can outlive the Bash timeout, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its chained steps one by one in the foreground, never background them (no shell `&`, no `run_in_background`, no `Monitor`) — you won't be re-woken to read the result. If no chained step fits under any foreground timeout, stop and report `BLOCKED` instead of improvising a background wait. When you can't explain WHY it failed, apply `.claude/skills/debug-failure/SKILL.md` before touching anything — the size of the output is not the trigger, the missing root cause is, and a failure whose error stream you truncated away reads the same as one you understand. If your second fix attempt fails the same way, that same skill's hypothesis re-check governs instead of throwing a third patch.
+   If it fails: fix it and re-run. Don't return with red. You are the single owner of this gate run: never share it with another process, never poll `pgrep`/`ps` for it, and a timeout is never a success signal. If the gate can outlive the Bash timeout, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its chained steps one by one in the foreground, never background them (<!-- navori:if-not onCodex -->no shell `&`, no `run_in_background`, no `Monitor`<!-- /navori:if-not --><!-- navori:if onCodex -->no shell `&`, no background execution<!-- /navori:if -->) — you won't be re-woken to read the result. If no chained step fits under any foreground timeout, stop and report `BLOCKED` instead of improvising a background wait. When you can't explain WHY it failed, apply `.claude/skills/debug-failure/SKILL.md` before touching anything — the size of the output is not the trigger, the missing root cause is, and a failure whose error stream you truncated away reads the same as one you understand. If your second fix attempt fails the same way, that same skill's hypothesis re-check governs instead of throwing a third patch.
 5. **UI**: for screen changes, the default evidence is the repo's tests plus a correct diff — **do NOT spin up a browser or dev server automatically**. Visual/browser validation is **optional and strictly on-request**: run it only when the user explicitly asks to check the UI in this prompt, and then drive the repo's browser-automation tool if one is set up (e.g. `playwright-cli`, whose installer ships its own skill).
 6. **No commits** without the `reviewer`'s approval. When you finish, <!-- navori:if-not scribeOwnsMarkdown -->write the report<!-- /navori:if-not --><!-- navori:if scribeOwnsMarkdown -->write your JSON evidence<!-- /navori:if --> and return the reference.
 <!-- navori:if planTiers -->

package/dist/assets/core/core-assets/agents/reviewer.md

@@ -4,7 +4,7 @@ description: Strict reviewer — approves or rejects a diff against CLAUDE.md an
 tools: Read, Glob, Grep, Bash, Write
 model: {{models.reviewer}}
 effort: {{effort.reviewer}}
-maxWords: 2372
+maxWords: 2387
 ---
 
 # Reviewer Agent
@@ -80,7 +80,7 @@ Apply `.claude/skills/review-diff/SKILL.md` — the full checklist by dimensions
 {{qualityGate.full}}
 ```
 
-Read it in full to verify (exit code + failure count), but leave only `exit 0` + the summary line in the report (e.g. `N passed`); when red, only the failing tail. Don't drag the full verbose log turn to turn. This evidence —green gate over the final diff, this cycle— is what the `publisher` reuses so it does **not** re-run the gate, so it must be fresh and over the diff that's going to be committed. You are the single owner of this gate run: the only handle that exists is this Bash call itself, correlated to the diff you're reviewing this turn — never share it with another process, and never poll `pgrep`/`ps` for it (it also matches other sessions' commands and never exits). A timeout is never a success signal. Run it in the foreground with the Bash tool's max `timeout`; if `{{qualityGate.full}}` can exceed it, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its `&&`-chained steps one by one in the foreground, each under the timeout — never background it (no shell `&`, no `run_in_background`, no `Monitor`), you won't be re-woken to read the result. If no chained step fits under any foreground timeout, stop and report `BLOCKED` instead of improvising a background wait.
+Read it in full to verify (exit code + failure count), but leave only `exit 0` + the summary line in the report (e.g. `N passed`); when red, only the failing tail. Don't drag the full verbose log turn to turn. This evidence —green gate over the final diff, this cycle— is what the `publisher` reuses so it does **not** re-run the gate, so it must be fresh and over the diff that's going to be committed. You are the single owner of this gate run: the only handle that exists is this Bash call itself, correlated to the diff you're reviewing this turn — never share it with another process, and never poll `pgrep`/`ps` for it (it also matches other sessions' commands and never exits). A timeout is never a success signal. Run it in the foreground with the Bash tool's max `timeout`; if `{{qualityGate.full}}` can exceed it, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its `&&`-chained steps one by one in the foreground, each under the timeout — never background it (<!-- navori:if-not onCodex -->no shell `&`, no `run_in_background`, no `Monitor`<!-- /navori:if-not --><!-- navori:if onCodex -->no shell `&`, no background execution<!-- /navori:if -->), you won't be re-woken to read the result. If no chained step fits under any foreground timeout, stop and report `BLOCKED` instead of improvising a background wait.
 
 Don't gate a screen change on browser validation by default. Only if the user explicitly requested a visual/browser check and it wasn't done do you mark it incomplete — otherwise the diff + the repo's tests are the gate.
 

package/dist/assets/core/core-assets/hooks/_partials/audit-log.sh

@@ -249,6 +249,9 @@ navori_audit_log() {
   # must treat "names nobody" as invalid data rather than as a different agent
   # (`ownerOf` in `lib/audit/parse.ts` is where that rule lives).
 
+  # Optional third argument `kind` (hard | ask | advisory): how binding the
+  # outcome was. Additive: callers that pass nothing keep today's records, and
+  # readers treat a missing `kind` as unclassified.
   printf '%s\n' "$(jq -cn \
     --arg name "${navori_audit_name:-unknown}" \
     --arg phase "${navori_audit_phase:-unknown}" \
@@ -258,13 +261,15 @@ navori_audit_log() {
     --arg src "${navori_audit_source:-core}" \
     --arg agent "${navori_audit_agent:-}" \
     --arg toolUseId "${navori_audit_tool_use_id:-}" \
+    --arg kind "${3:-}" \
     --argjson ms "$navori_audit_ms" \
     --argjson tsMs "$navori_audit_end" \
     '{tsMs:$tsMs,event:"hook",name:$name,phase:$phase,verdict:$verdict,ms:$ms,source:$src}
      + (if $tool   == "" then {} else {tool:$tool}       end)
      + (if $reason == "" then {} else {reason:$reason}   end)
      + (if $agent  == "" then {} else {agentId:$agent}   end)
-     + (if $toolUseId == "" then {} else {toolUseId:$toolUseId} end)' 2>/dev/null)" \
+     + (if $toolUseId == "" then {} else {toolUseId:$toolUseId} end)
+     + (if $kind == "" then {} else {kind:$kind} end)' 2>/dev/null)" \
     >> "$navori_audit_file" 2>/dev/null
 
   return 0

package/dist/assets/core/core-assets/hooks/_partials/bash-outcome.sh

@@ -88,8 +88,16 @@ navori_json_str() {
 # Repeat-failure state is shared by the PostToolUseFailure watcher and the
 # existing success lane. A successful Bash call only pays for Node when its
 # session already has a failure-state file; ordinary calls use builtins only.
+#
+# `action` is `reset`/`failure` (Claude: the event says which) or `codex`
+# (spec 0041 T12: Codex fires PostToolUse on failure too, so the OUTCOME is read
+# from the rollout, `$2` = its path, `$3` = the call's `tool_use_id`).
 navori_bash_failure_state() {
   local action=$1 sid=${CLAUDE_CODE_SESSION_ID:-} dir file
+  if [ "$action" = codex ]; then
+    navori_plain_field session_id
+    sid=$navori_field
+  fi
   case "$sid" in "" | *[!A-Za-z0-9._-]*) return 0 ;; esac
   [ -n "${nv_project_dir:-}" ] || return 0
   dir=$nv_project_dir/.navori/state/hooks/bash-outcome-watch
@@ -99,24 +107,58 @@ navori_bash_failure_state() {
   fi
   command -v node >/dev/null 2>&1 || return 0
   NV_BASH_OUTCOME_ACTION=$action NV_BASH_OUTCOME_DIR=$dir NV_BASH_OUTCOME_FILE=$file \
+    NV_BASH_OUTCOME_SID=$sid NV_BASH_OUTCOME_TRANSCRIPT=${2:-} NV_BASH_OUTCOME_TOOL_USE=${3:-} \
     NV_BASH_OUTCOME_ROOT=$nv_project_dir node -e '
 const fs = require("node:fs");
 const path = require("node:path");
 const crypto = require("node:crypto");
 const digest = (value) => crypto.createHash("sha256").update(value).digest("hex");
 const env = process.env;
+// Codex outcome (spec 0041 T12): the exit code of THIS call lives in the rollout
+// record `event_msg`/`item_completed` whose `item.id` is the `tool_use_id` of the call
+// (probe V4). Bounded to the tail of the file; only `exit_code` is read, never
+// the output fields. Anything missing or unreadable -> null -> silence.
+const codexExit = () => {
+  const max = 1048576;
+  const fd = fs.openSync(env.NV_BASH_OUTCOME_TRANSCRIPT, "r");
+  try {
+    const size = fs.fstatSync(fd).size;
+    const len = Math.min(size, max);
+    const buf = Buffer.alloc(len);
+    fs.readSync(fd, buf, 0, len, size - len);
+    const lines = buf.toString("utf8").split("\n");
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line = lines[i];
+      if (!line.includes(env.NV_BASH_OUTCOME_TOOL_USE) || !line.includes("item_completed")) continue;
+      let record;
+      try { record = JSON.parse(line); } catch { continue; }
+      const item = record?.payload?.item;
+      if (record?.type !== "event_msg" || record?.payload?.type !== "item_completed") continue;
+      if (item?.type !== "CommandExecution" || item?.id !== env.NV_BASH_OUTCOME_TOOL_USE) continue;
+      return Number.isInteger(item.exit_code) ? item.exit_code : null;
+    }
+    return null;
+  } finally { fs.closeSync(fd); }
+};
 let input = "";
 process.stdin.setEncoding("utf8");
 process.stdin.on("data", (chunk) => { input += chunk; });
 process.stdin.on("end", () => {
   try {
     const payload = JSON.parse(input);
-    if (payload.tool_name !== "Bash" || payload.session_id !== env.CLAUDE_CODE_SESSION_ID) return;
+    if (payload.tool_name !== "Bash" || payload.session_id !== env.NV_BASH_OUTCOME_SID) return;
     if (payload.is_interrupt === true || payload.tool_response?.is_interrupt === true) return;
     const command = payload.tool_input?.command;
     const cwd = payload.cwd;
     if (typeof command !== "string" || !command.trim() || typeof cwd !== "string" || !cwd) return;
     const agent = typeof payload.agent_id === "string" ? payload.agent_id : "";
+    let action = env.NV_BASH_OUTCOME_ACTION;
+    let exitCode = null;
+    if (action === "codex") {
+      exitCode = codexExit();
+      if (exitCode === null) return;
+      action = exitCode === 0 ? "reset" : "failure";
+    }
     const key = digest(JSON.stringify([command.trim().replace(/\s+/g, " "), cwd, agent]));
     const root = path.resolve(env.NV_BASH_OUTCOME_ROOT);
     const dir = env.NV_BASH_OUTCOME_DIR;
@@ -125,21 +167,21 @@ process.stdin.on("end", () => {
     for (const component of [root, path.join(root, ".navori"), path.join(root, ".navori/state"), path.join(root, ".navori/state/hooks"), dir]) {
       if (fs.existsSync(component)) {
         if (!fs.lstatSync(component).isDirectory() || fs.lstatSync(component).isSymbolicLink()) return;
-      } else if (env.NV_BASH_OUTCOME_ACTION === "failure") {
+      } else if (action === "failure") {
         fs.mkdirSync(component);
       } else return;
     }
     if (fs.existsSync(file) && (!fs.lstatSync(file).isFile() || fs.lstatSync(file).isSymbolicLink())) return;
     let rows = fs.existsSync(file) ? fs.readFileSync(file, "utf8").split("\n").filter(Boolean).map((line) => JSON.parse(line)) : [];
     if (!Array.isArray(rows) || rows.some((row) => typeof row.key !== "string" || typeof row.sig !== "string" || typeof row.count !== "number" || typeof row.epoch !== "number")) return;
-    if (env.NV_BASH_OUTCOME_ACTION === "reset") {
+    if (action === "reset") {
       const next = rows.filter((row) => row.key !== key);
       if (next.length === rows.length) return;
       rows = next;
     } else {
-      const error = payload.error;
+      const error = exitCode === null ? payload.error : "";
       if (typeof error !== "string") return;
-      const match = /exit code\s+(\d+)/i.exec(error);
+      const match = exitCode === null ? /exit code\s+(\d+)/i.exec(error) : [null, String(exitCode)];
       if (!match) return;
       const code = match[1];
       const escapedRoot = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -154,7 +196,7 @@ process.stdin.on("end", () => {
         .replace(/\b\d+(?:\.\d+)?\s?(?:ms|seconds?|minutes?)\b/gi, "<d>")
         .replace(/\b[0-9a-f]{8,}\b/gi, "<h>")
         .split("\n").map((line) => line.trim()).filter(Boolean).slice(0, 20).join("\n");
-      if (!body) return;
+      if (!body && exitCode === null) return;
       const sig = digest(code + "\n" + body);
       const previous = rows.find((row) => row.key === key);
       const count = previous?.sig === sig ? Math.min(previous.count + 1, 3) : 1;
@@ -163,7 +205,7 @@ process.stdin.on("end", () => {
       rows.push({ key, sig, count, notified: notified || count === 3, epoch: Date.now() });
       if (count === 3 && !notified) {
         const first = body.split("\n")[0].slice(0, 100);
-        const note = `navori: el comando ${command.trim().slice(0, 100)} falló 3 veces con la misma firma (exit ${code}: ${first}). Cambia de enfoque con debug-failure o escala al usuario. Si el rojo es intencional, ignora esta nota.`;
+        const note = `navori: el comando ${command.trim().slice(0, 100)} falló 3 veces con la misma firma (exit ${code}${first ? ": " + first : ""}). Cambia de enfoque con debug-failure o escala al usuario. Si el rojo es intencional, ignora esta nota.`;
         var output = note.slice(0, 400);
       }
     }
@@ -179,6 +221,51 @@ process.stdin.on("end", () => {
   return 0
 }
 
+# A plain top-level string field of the raw payload, with builtins only (no
+# fork), into `navori_field`. Matches `"key":"value"` with an unescaped quote
+# before the colon, which a `tool_response` cannot forge (inside it every quote is
+# `\"`). Empty when absent, spaced or escaped: the caller treats that as silence.
+navori_plain_field() {
+  local needle="\"$1\":\"" rest
+  navori_field=
+  case "$payload" in *"$needle"*) ;; *) return 0 ;; esac
+  rest=${payload#*"$needle"}
+  navori_field=${rest%%\"*}
+  case "$navori_field" in *\\*) navori_field= ;; esac
+  return 0
+}
+
+# Spec 0041 T12 (R11): the Codex Bash outcome lane, run by `routing-watch.sh`
+# on `PostToolUse(Bash)` under Codex. Codex fires PostToolUse on failure too, so
+# the exit code is read from the rollout (`transcript_path`): a fixed-string grep
+# over the BOUNDED tail finds the `item_completed` record of this `tool_use_id`.
+# A success with no failure state costs no Node; everything else (a failure, or a
+# success that must reset a counter) goes through `navori_bash_failure_state`,
+# which parses only `exit_code`. FAIL-OPEN and silent: no rollout, no matching
+# record or an unreadable one means no advice. Prints the advice, if any.
+navori_bash_codex_outcome() {
+  local tid tp sid line
+  navori_plain_field tool_use_id
+  tid=$navori_field
+  navori_plain_field transcript_path
+  tp=$navori_field
+  navori_plain_field session_id
+  sid=$navori_field
+  case "$tid" in "" | *[!A-Za-z0-9._:-]*) return 0 ;; esac
+  case "$sid" in "" | *[!A-Za-z0-9._-]*) return 0 ;; esac
+  case "$tp" in *.jsonl) ;; *) return 0 ;; esac
+  [ -f "$tp" ] && [ -r "$tp" ] || return 0
+  line=$(tail -c 1048576 "$tp" 2>/dev/null | grep -F -- "$tid" 2>/dev/null | grep -F '"item_completed"' 2>/dev/null | tail -n 1)
+  [ -n "$line" ] || return 0
+  case "$line" in
+    *'"exit_code":0,'* | *'"exit_code":0}'*)
+      [ -f "${nv_project_dir:-}/.navori/state/hooks/bash-outcome-watch/$sid" ] || return 0
+      ;;
+  esac
+  navori_bash_failure_state codex "$tp" "$tid"
+  return 0
+}
+
 # Called by `routing-watch.sh` once it knows the tool is `Bash`, and only under
 # `claude-post-tool-use` (Codex fires PostToolUse on failure too, so no signal).
 navori_bash_success_lane() {

package/dist/assets/core/core-assets/hooks/_partials/hook-input.sh

@@ -90,6 +90,39 @@ nv_subagent_type() {
   fi
 }
 
+# The agent a spawn call TARGETS, never the one that makes the call (spec 0041
+# H16). Claude: `tool_input.subagent_type`. Codex PreToolUse/PostToolUse of a
+# spawn: `tool_input.agent_type` only — the top-level `agent_type` there is the
+# CALLER's. On `SubagentStop` the top-level `agent_type` IS the finishing
+# subagent, so that event reads it instead.
+nv_spawn_target_type() {
+  if [ "$nv_engine" = codex ]; then
+    case "$(payload_field hook_event_name)" in
+      SubagentStop) payload_field agent_type ;;
+      *) payload_field tool_input.agent_type ;;
+    esac
+  else
+    payload_field tool_input.subagent_type
+  fi
+}
+
+# The agent RUNNING the current event: the top-level `agent_type`, which the
+# host adds only inside a subagent (empty on the main thread). Never confuse it
+# with `nv_spawn_target_type` (H16). `nv_subagent_type` above keeps its legacy
+# mixed behaviour for existing hooks; new code uses these two helpers.
+nv_event_agent_type() {
+  payload_field agent_type
+}
+
+# True for the spawn tool: Codex V1 `spawn_agent`, or any V2 name that ends in
+# `spawn_agent` (V2 flattens the namespace into the tool name).
+nv_is_spawn_tool() {
+  case "$(payload_field tool_name)" in
+    *spawn_agent) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 # Deliberately NO `nv_emit_context` helper here. `hook-output-contract.test.ts`
 # ("los partials no hablan con el host, solo escriben al log") holds every
 # `_partials/*.sh` file to zero host-output vocabulary — a partial is inlined

package/dist/assets/core/core-assets/hooks/general-purpose-confirm.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# PreToolUse(Agent): dispatching `general-purpose` is raised to a user
+# PreToolUse(Agent|spawn_agent): dispatching `general-purpose` is raised to a user
 # confirmation that names the `scout` (spec 0039 R40).
 #
 # WHY: `general-purpose` is the host's catch-all subagent. For read-only
@@ -44,9 +44,23 @@ navori_audit_on_exit() {
 }
 trap navori_audit_on_exit EXIT
 
+# Claude names the child `subagent_type`; Codex's `spawn_agent` names it `agent_type`.
 navori_gp_type=$(payload_field tool_input.subagent_type)
+[ -n "$navori_gp_type" ] || navori_gp_type=$(payload_field tool_input.agent_type)
 [ "$navori_gp_type" = "general-purpose" ] || exit 0
 
+# Codex hooks cannot emit `ask`, and a `prompt` rule does not confirm inside
+# subagents (live probe V1, spec 0041 R10): the Codex copy denies instead,
+# decided by `$0` like `comment-draft-confirm.sh`. Never an allow.
+case "$0" in
+  *".codex/hooks/"*)
+    navori_audit_verdict="deny"
+    navori_audit_reason="general-purpose despachado; scout cubre lectura e investigación"
+    printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[navori] general-purpose is dispatched here and Codex hooks cannot prompt. For read-only exploration or web research dispatch the scout instead; if this task really needs general-purpose, ask the user to confirm and re-dispatch."}}'
+    exit 0
+    ;;
+esac
+
 navori_audit_verdict="ask"
 navori_audit_reason="general-purpose despachado; scout cubre lectura e investigación"
 

package/dist/assets/core/core-assets/hooks/master-accept-confirm.sh

@@ -61,6 +61,18 @@ is_scan_trigger "$cmd" || exit 0
 
 # Fixed by construction: no repository content reaches JSON, so this still
 # works when jq and node are unavailable.
-navori_audit_verdict="ask"
-navori_audit_reason="manual approval or stage close"
-printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"[navori] this records that you approved a manual criterion. Confirm only if you reviewed it."}}'
+# Codex parses `permissionDecision` but drops `"ask"` (the call proceeds), so
+# the Codex copy denies instead: deny-as-confirmation, decided by `$0` like
+# `comment-draft-confirm.sh` (spec 0041 D11). Never an allow.
+case "$0" in
+  *".codex/hooks/"*)
+    navori_audit_verdict="deny"
+    navori_audit_reason="manual approval or stage close"
+    printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[navori] this records that the user approved a manual criterion, and Codex hooks cannot prompt. Show the user what it approves and let them confirm and run the command themselves."}}'
+    ;;
+  *)
+    navori_audit_verdict="ask"
+    navori_audit_reason="manual approval or stage close"
+    printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"[navori] this records that you approved a manual criterion. Confirm only if you reviewed it."}}'
+    ;;
+esac

package/dist/assets/core/core-assets/hooks/master-plan-context.sh

@@ -21,7 +21,13 @@ trap navori_audit_on_exit EXIT
 
 specs_dir={{shq:sdd.specsDir}}
 NAVORI_MASTER_LINE_BUDGET=600
-project_dir=${CLAUDE_PROJECT_DIR:-$PWD}
+# Codex sets no CLAUDE_PROJECT_DIR: the root is the git toplevel of the hook's
+# directory; `$0` tells the copies apart (spec 0041 R21, same pattern as
+# `comment-draft-confirm.sh`).
+case "$0" in
+  *".codex/hooks/"*) project_dir=$(git rev-parse --show-toplevel 2>/dev/null) || project_dir=$PWD ;;
+  *) project_dir=${CLAUDE_PROJECT_DIR:-$PWD} ;;
+esac
 index_path=$project_dir/$specs_dir/_master/INDEX.md
 offer='En tu primera respuesta de la sesión, ofrece continuar con el plan maestro en una sola línea, sin interrumpir lo que el usuario pidió.'
 

package/dist/assets/core/core-assets/hooks/plan-gate.sh

@@ -26,9 +26,11 @@
 # below, in ONE invocation (a second `--help` probe would read the hook's
 # stdin payload twice, which a pipe cannot replay).
 #
-# CODEX. Spec 0035 defers registration of this hook: a live Codex smoke
-# created an implementer without a workplan despite PreToolUse registration.
-# The workplan procedure remains advisory until the host reliably blocks it.
+# CODEX (spec 0041 R9). Registered on PreToolUse(spawn_agent$) as the last late
+# row. Only `implementer` is gated, with the role from `tool_input.agent_type`.
+# Codex V2 encrypts the spawn `message`, so the opening line then comes from the
+# orchestrator's `.navori/state/handoffs/dispatch_<feature>.json` (TTL 10 min,
+# exactly one fresh file); the decision logic stays in `navori plan gate`.
 #
 # The managed block below is regenerated by `navori render` and must NOT be
 # edited by hand.

package/dist/assets/core/core-assets/hooks/pr-publisher-confirm.sh

@@ -95,6 +95,22 @@ is_scan_trigger "$cmd" || exit 0
 # It names SOME subagent, not specifically the publisher — a `scout` opening a
 # PR would pass. That is deliberate: this is a routing nudge, not a security
 # boundary, and the detector cannot see through `sh -c` either.
+#
+# CODEX (spec 0041 R10): Codex hooks cannot emit `ask` and a `.codex/rules`
+# `prompt` rule only confirms on the main thread — it is silent inside the
+# publisher subagent (live probe V1) — so the Codex copy denies instead:
+# deny-as-confirmation, decided by `$0` like `comment-draft-confirm.sh`. It runs
+# BEFORE the subagent allow, because the publisher is exactly where the
+# unconfirmed `gh pr create` happens. Fixed by construction: no jq needed.
+case "$0" in
+  *".codex/hooks/"*)
+    navori_audit_verdict="deny"
+    navori_audit_reason="gh pr create requires user confirmation (Codex)"
+    printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[navori] this `gh pr create` opens a PR and Codex hooks cannot prompt. Show the user the title and body, and let them confirm and run the command themselves."}}'
+    exit 0
+    ;;
+esac
+
 navori_pr_agent=$(payload_field agent_id)
 [ -n "$navori_pr_agent" ] || navori_pr_agent=$(payload_field subagent_id)
 if [ -n "$navori_pr_agent" ]; then

package/dist/assets/core/core-assets/hooks/quality-gate-pre-commit.sh

@@ -50,6 +50,9 @@ navori_audit_ran_gate=0
 navori_audit_skip_reason="el comando no es un commit"
 # Set when the gate had NO verdict (runner missing) and the user was asked (#1117).
 navori_audit_ask_reason=""
+# Set right before each deliberate `exit 2`, so every block path records its own
+# cause (#1117). Empty means the exit came from somewhere unforeseen.
+navori_audit_block_reason=""
 navori_audit_on_exit() {
   navori_audit_code=$?
   # A cancelled hook reaches this trap with `$?` == 0 (#797), so the exit code
@@ -60,9 +63,9 @@ navori_audit_on_exit() {
     return 0
   fi
   if [ "$navori_audit_code" -ne 0 ]; then
-    navori_audit_log "block" "el quality gate no paso o no pudo correr" || true
+    navori_audit_log "block" "${navori_audit_block_reason:-el quality gate no paso o no pudo correr}" hard || true
   elif [ -n "$navori_audit_ask_reason" ]; then
-    navori_audit_log "ask" "$navori_audit_ask_reason" || true
+    navori_audit_log "ask" "$navori_audit_ask_reason" ask || true
   elif [ "$navori_audit_ran_gate" -eq 1 ]; then
     navori_audit_log "allow" "gate ejecutado y verde" || true
   else
@@ -108,6 +111,7 @@ run_gate() {
   navori_audit_log "gate-started" "inicio del quality gate" || true
   echo "[navori] running quality-gate fast: $1" >&2
   eval "$1" || {
+    navori_audit_block_reason="quality gate en rojo: '$1' fallo, commit abortado"
     echo "[navori] quality-gate fast failed. Commit aborted." >&2
     exit 2
   }
@@ -178,7 +182,10 @@ if [ "$run_needed" = 1 ]; then
   # Codex); when nothing resolves the substitution is empty and `cd ""` is a
   # no-op, so behavior outside a repo is unchanged.
   gate_root=$(navori_worktree)
-  cd "${gate_root:-${nv_project_dir:-}}" || exit 2
+  cd "${gate_root:-${nv_project_dir:-}}" || {
+    navori_audit_block_reason="no se pudo entrar al arbol del commit '${gate_root:-${nv_project_dir:-}}'; el gate no corrio"
+    exit 2
+  }
   # qualityGate.fast is shell-quoted at render time via the shq: marker (#197).
   # The gate string is still `eval`'d by run_gate below (running the gate is the
   # feature), but quoting it here means a hostile qualityGate.fast survives as one
@@ -205,6 +212,7 @@ if [ "$run_needed" = 1 ]; then
       # The explicit engine test is the static proof (hook-claims-vs-scripts) that
       # the Codex path differs; `navori_can_ask` re-checks it with the payload.
       if [ "$nv_engine" = codex ] || ! navori_can_ask; then
+        navori_audit_block_reason="quality gate sin veredicto y sin forma de preguntar: '$gate_bin' no esta en PATH, commit bloqueado"
         echo "[navori] Commit BLOCKED to avoid skipping the gate silently. Install '$gate_bin', or if you really want to skip it run the commit yourself outside the agent." >&2
         exit 2
       fi